macOS processes

What is mDNSResponder on Mac?

mDNSResponder answers DNS lookups for every app on the Mac, and it runs Bonjour on the local network. Its traffic is the lookups of other apps.

Process: mDNSResponderProcess: mDNSResponderHelperApplies to: All current macOS versions. Seen on macOS 27.2.Checked: 29 October 2026

Where you see it

  • mDNSResponder is in the list in Activity Monitor › Network, in nettop or in Kilobat.
  • A firewall or network monitor asks if mDNSResponder can connect.
  • Its packet counts are high, but its bytes are low.

What it is

The man page calls it the “Multicast and Unicast DNS daemon”. It implements Multicast DNS and DNS Service Discovery, which Apple calls Bonjour.

Since Mac OS X 10.6, it is also the system-wide DNS resolver. It sends DNS queries for other processes and keeps a cache of the answers.

The program is /usr/sbin/mDNSResponder. mDNSResponderHelper is a helper with its own man page.

Why it uses the network

  • DNS lookups for apps. Each time an app connects to a name, mDNSResponder can send a DNS query for it. Many apps make many lookups.
  • Bonjour on the local network. It listens on UDP port 5353 for Multicast DNS. It finds printers, speakers and other Macs.
  • Encrypted DNS. With an encrypted DNS profile, lookups go to that DNS server over HTTPS or TLS. See Use encrypted DNS on a Mac.

Is it normal?

Yes. DNS answers are small, so mDNSResponder usually moves less data than the apps that it works for.

Look closer if its traffic is high for a long time. A program that makes very many lookups, or a busy local network, can cause this.

See how much it uses

  1. Open Activity Monitor from Applications > Utilities. Click Network.

  2. Type mDNSResponder in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.

  3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

    nettop -p mDNSResponder -P

  4. To see the DNS servers that it uses, show the resolver configuration.

    scutil --dns

Reduce or pause it safely

  1. Find the app that makes the lookups. Its own traffic often rises at the same time in Activity Monitor.

  2. Quit or pause that app. The lookups stop with it.

  3. If lookups fail and repeat, fix DNS first. See DNS not resolving on a Mac.

  4. If old answers cause errors, flush the DNS cache. See Flush the DNS cache on a Mac.

  5. Do not quit mDNSResponder in Activity Monitor. It is part of macOS, and other features depend on it. Without it, no app on the Mac can look up names.

With Kilobat

  1. Open the Kilobat app list and search for mDNSResponder. Its row shows the live rate and the bytes it moved.

  2. Compare the speed of DNS servers from this Mac.

    kilobat dns-benchmark

  3. In Terminal, see the same live list. Press / and type the name to search.

    kilobat status --watch

  4. Show its traffic over one day. Names match kilobat report --summary.

    kilobat bandwidth mDNSResponder day

  5. Through MCP, an AI agent gets the same history with get_app_bandwidth and the name mDNSResponder.

  6. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

Questions

Is mDNSResponder spyware?

No. It is Apple's DNS and Bonjour daemon in /usr/sbin, with a man page. The man page says that users should not run it manually.

Why does a firewall ask about mDNSResponder?

All DNS lookups on the Mac go through it. A firewall that watches DNS sees mDNSResponder, not the app that asked.

Sources

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.